SERVER-14886 BSONElementIterator::next() set array offset correctly

(cherry picked from commit acc09c2ec26b27c6d201f5f98a2a9c7b4215b1ae)
Merge remote-tracking branch 'upstream/v2.6' into v2.6